Information Management Assessment

Crown Prosecution Service

Reviewed July 2017

Published February 2018

Working with government to raise standards in information management Contents

Background 02 Executive summary 03 Good practice areas 05 Recommendations to address risk areas 06 Key findings of the assessment 07 Annex A – Recommendations in full 14

© Crown copyright 2017

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background

The Information Management Assessment involved a detailed review of supporting documentation followed by interviews with senior staff (including a non-executive Director and Senior Auditor Government Internal Audit Agency), specialists and practitioners from the department’s Headquarters London, Yorkshire & Wakefield offices, London South & North, West & East Midlands, Wales and West Yorkshire Area offices, Organised Crime & Extradition Division, Specialist Fraud Division and Proceeds of Crime Division. These were conducted between 3 and 6 July 2017. This report provides a summary of the good practice and risks we identified and recommendations to address these risks.

In advance of each Information Management Assessment we recommend that permanent secretaries/chief executive officers publish a statement of commitment to the assessment process that also underlines the importance of good practice in information and records management. No statement of commitment was published in advance of the Crown Prosecution Service (CPS) assessment. However, we understand that the chief executive has agreed and been supportive of this review. Executive summary

- There are ten performance headings embedded in this Information Management Assessment report. The Crown Prosecution Service (CPS) receives a Satisfactory rating under four of the headings. This rating indicates an approach to support efficiency, effectiveness and compliance with legal obligations and responsibilities.

- CPS receives six medium priority Development area ratings. A Development area rating indicates a key issue or gap in process or governance that may trigger a range of risks.

Ratings received ranked by priority

| Performance Rating: Satisfactory | Priority: Low | |----------------------------------|--------------| | Report section | | | 1.1 Communicating and realising value (page 7) | | | 1.2 Managing information as an asset (page 7) | | | 3.2 Establishing control (page 10) | | | 4.1 Oversight of records and selection (page 12) | |

To maintain performance under these headings, CPS needs to:

- join up its strategic goals for information and records management, demonstrating how these support the wider strategic direction within the department, and ensure there is a plan for implementation

- maintain capability in order to appraise, select and transfer paper records in accordance with the Public Records Act and the 20-year rule.

| Performance rating: Development area | Priority | Medium | |--------------------------------------|----------|--------| | Report section | | | | 2.1 Supporting information through technology (page 8) | | | | 2.2 Digital continuity and IT change (page 9) | | | | 3.1 Recognising information risk (page 10) | | | | 3.3 Providing guidance (page 11) | | | | 3.4 Measuring impact (page 12) | | | | 4.2 Implementing disposal decisions (page 12) | | |

To improve performance under these headings, CPS needs to:

- work to ensure that it has the right systems and processes in place to manage digital information (both case and non-case information), and take steps to ensure that its digital information remains available and usable throughout change and over time

- routinely recognise risks around capturing and keeping the right information to ensure it is available to the right people at the right time, and managing these as part of the risk management framework

- ensure that it has up to date policy and guidance in place to support a good culture of information and records management, particularly in light of future IT developments such as Office 365 and the Common Platform

- build on the good work it has already done for security and information assurance, ensuring it has the right governance structures and processes in place in compliance with information and records management policy

- work closely with The National Archives to develop a process for carrying out appraisal, selection, sensitivity review and transfer of digital information.

IMA reports and departmental action plans are published on The National Archives’ website at: nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm Good practice areas

The following areas of good practice were identified at the time of the assessment. They include systems and approaches that other government organisations may find helpful in mitigating information and records management related risks:

| Highlights of the 2017 IMA | |---------------------------| | Information and records management is seen as an integral part of the Crown Prosecution Service’s (CPS) approach to information assurance. The Security and Information Assurance Policy covers information and records management, the role of the Information Management Unit, and the responsibilities of the Departmental Records Officer. The Data Strategy makes reference to the Records Management Manual and the Public Records Act. Information management is also part of the regular assurance process. | | CPS has worked hard to develop an approach to information assurance training for staff. This includes twice-yearly training for Information Asset Owners (IAO) and induction training for new Information Management Advisors which equips them to train staff in their business areas. Business areas have run training in the proper handling of data – for example, CPS West Midlands ran a campaign that hit approximately 90% of staff, and CPS Wales ran a poster campaign. | | CPS has an Information Assurance Group which meets bi-monthly, and includes members from records, security, digital and information rights teams. We saw evidence that it is used as a forum to discuss information and records management issues – for example, retention, the moratorium on destruction, and management of email as part of the case record. These subjects were all discussed at recent meetings. | | CPS has established criteria to help staff identify long term interest cases. For example, murders or cases that set a legal precedent are in place. Business areas are aware of these criteria and send cases that fall within these to the Records Management Unit (RMU). The RMU review the cases and decide whether they are of historical value and should be transferred to The National Archives. | | CPS has worked closely with Iron Mountain and The National Archives to establish processes, and train staff to the required standards in sensitivity review and preparation of records for transfer. The RMU quality checks the work carried out by Iron Mountain and feeds back any issues so they can be addressed. |

## Recommendations to address risk areas

Further detail can be found in Annex A

| Recommendation | To address a high-priority development area rating | |----------------|---------------------------------------------------| | | There are no recommendations that fall within this category. |

| Recommendation | To address a medium-priority development area rating | |----------------|---------------------------------------------------| | 1 | The Crown Prosecution Service (CPS) must ensure that it has up to date policy and guidance in place to support a good culture of information and records management particularly in light of future IT developments such as Office 365 and the Common Platform. | | 2 | Building on the good work it has already done for security and information assurance, CPS needs to ensure it has the right governance structures and processes in place to support and monitor compliance with information and records management policy. | | 3 | CPS should continue work to ensure that it has the right systems and processes in place to manage digital information (both case and non-case information). | | 4 | CPS should take steps to ensure that its digital information remains available and usable throughout change and over time. | | 5 | CPS needs to ensure that risks around capturing and keeping the right information (to ensure it is available to the right people at the right time) are routinely recognised and managed as part of the risk management framework. | | 6 | Working closely with The National Archives, CPS needs to develop a process for carrying out appraisal, selection, sensitivity review and transfer of digital information. |

| Recommendation | To maintain a satisfactory rating | |----------------|----------------------------------| | 7 | CPS should join up its strategic goals for information and records management, demonstrate how these support the wider strategic direction within the department, and ensure there is a plan for implementation. | | 8 | CPS needs to maintain capability in order to appraise, select and transfer paper records in accordance with the Public Records Act and the 20-year rule. | Key findings of the assessment

1 The value of information

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------|----------| | 1.1 Communicating and realising value| Satisfactory | Low |

- There is a strong culture within the Crown Prosecution Service (CPS) of the value of case information and appropriate handling of this, both from a security and records management perspective. This is promoted from the top of the organisation through the two Senior Information Risk Owners (SIROs), Information Asset Owners (IAO) – at Chief Crown Prosecutor level – and Area Business Managers (ABM). Staff we spoke to clearly recognised the value of information and the importance of managing and protecting it appropriately.

- CPS has a Data Strategy and records management is included as a core part. For example, the strategy makes mention of ensuring compliance with the Public Records Act, and that the records management guidance is up to date and fit for purpose. This strategy is aligned with CPS 2020. There are also eight goals for information management set out in the Security and Information Assurance Policy, but it is unclear how these link up with the Data Strategy. The need to drive and maintain a good culture of information and records management isn’t specifically mentioned as part of these goals, but it should be. CPS needs to join up its strategic goals for information and records management, and demonstrate how these support the wider strategic direction within the department including the digital and architecture strategies. It should also put in place a plan for implementation of these goals. See recommendation 7

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------|----------| | 1.2 Managing information as an asset | Satisfactory | Low |

- IAOs are very senior, and ABMs and others such as Information Management Advisors play a crucial role in supporting their work. We were pleased to note that IAOs and ABMs take their roles and responsibility for driving the right information assurance culture seriously and that there appears to be a strong relationship between these two roles. It is also positive to see that CPS has put in place guidance and training for IAOs and work is underway to make the Information Asset Register process more streamlined and less onerous. See good practice 2 Digital information and supporting technology

| Performance heading | Performance rating | Priority | |----------------------------------------------------------|--------------------|----------| | 2.1 Supporting information through technology | Development needed | Medium |

- CPS has gone through a major transformation for casework and is now working almost completely digitally. Compass case management system (CMS) is the core system used for the management of digital case records throughout their lifecycle, including disposal. The system doesn’t completely meet business needs but we were pleased to see that the importance of this system has been recognised. Enhancements are being carried out to ensure that it remains fit for purpose until potentially being replaced by the Common Platform. Business areas have the opportunity to feed into this work via their digital leads. CPS needs to ensure that it continues to engage with business areas about gaps and planned changes and update related guidance as appropriate. See recommendation 3

- CPS is yet to consider how it might export or migrate from CMS in the future and this needs to be addressed. See recommendation 3

- Although CMS is the recognised corporate repository for digital case records, shared drives are also used for the management of case and corporate information. This is particularly the case for large and complex cases that can’t be physically managed via CMS. From the evidence we saw, shared drives appear to be well structured and managed appropriately by business areas. However, there is no real protection from accidental or unauthorised alteration, copying, movement or deletion beyond permissions. CPS needs to establish an overall plan for how it will manage information on the shared drives in the medium and long term. See section 2.2 and recommendation 4

- SharePoint is also used for corporate information. CPS should ensure that any information it holds is managed appropriately throughout its lifecycle, and is factored into plans for digital appraisal and transfer as appropriate. See recommendation 6

- CPS is about to start moving to Office 365, starting with the migration of its email. CPS needs to be aware of the risks that the introduction of Office 365 may pose to effective records management – for example, the impact of unlimited storage on One Drive on the use of CMS (if staff have unlimited storage on One Drive there is no incentive to save records to CMS as required). See recommendation 3

- CPS is part of a joint project, along with the Police and HM Courts & Tribunals Service to move to the Common Platform for the criminal justice system. It is a complex project that is likely to raise difficult questions around what constitutes the case record and boundaries around ownership. This will have an impact on how CPS complies with information legislation such as the Public Records and Freedom of Information Acts. CPS needs to ensure that the Common Platform meets its requirements for information and records management. See recommendation 3

- CPS receives a substantial amount of video evidence on removable media such as DVDs and USBs and has set up processes to ensure that these are tracked, protected and managed appropriately. There has been some really positive work to find other ways of sharing digital evidence to reduce reliance on discs including the use of evidence.com and EGRESS. The move to easier ways of sharing this information digitally/online raises new risks around the secure management of this information throughout this process. CPS should ensure that this risk is recognised and that appropriate mitigations are in place. See recommendation 3

| Performance heading | Performance rating | Priority | |------------------------------|--------------------------|----------| | 2.2 Digital continuity and IT change | Development needed | Medium |

- CPS holds a large amount of information on its shared drives. The digital team has explored using software tools to help establish exactly what is held on the shared drives but there are no plans to pursue this further at present. CPS needs to establish an overall plan for how it will manage information on the shared drives in the medium and longer term including surveying what information is held there, identifying vulnerabilities associated with age/format and deciding what needs to be kept, migrated, or can be disposed of, subject to requirements of the Independent Inquiry into Child Sexual Abuse and the Undercover Policing Inquiry. See recommendation 4 and 6

- With regards to long term maintenance of video evidence that CPS receives, police forces retain the original evidence and are ultimately responsible for looking after it in the longer term. There is a risk that this information may become inaccessible, unavailable or unusable which CPS needs to define and work with police forces to mitigate. See recommendation 4

- We saw evidence to suggest that there are good informal links between IT and information management staff, although sometimes the pace of IT change makes this difficult. IT and Knowledge and Information (KIM) staff should continue working together to ensure that information and records management requirements are considered at the outset for new IT projects or programmes and as a standard part of the IT procurement process. See recommendation 4 3 Information risk, governance and oversight

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------------|----------| | 3.1 Recognising information risk | Development needed | Medium |

- At the time of the assessment, CPS had a draft Security and Information Assurance Policy. The policy sets out the approach to managing security and information risk, including a programme of work, roles and responsibilities. It also covers information and records management, and the roles and responsibilities of the Departmental Records Officer. See good practice. There is also a statement about how information assurance risk will be managed in the main Risk Management Policy. CPS needs to complete work on the Security and Information Assurance Policy, and consider how best to launch, promote and embed it across the organisation. See recommendation 5

- The CPS Assurance Framework requires business areas to report on the security and information management. This includes how information is used, stored and handled across digital (i.e. systems, discs, and hard drive storage) and paper platforms. We also saw evidence that business areas were including information risks in their risk registers. For example, the storage and transfer of sensitive information, and failure to improve systems, processes and staff awareness in respect of security risks; managing confidential information, and data handling.

- There is a very strong recognition of information risk from a security and data handling perspective. However, risks around capturing and keeping the right information, and ensuring it is available to the right people at the right time, are not routinely recognised. See recommendation 5

- We are pleased to note the strong risk-led response to the problem of inconsistent redaction of files by police forces, and management of evidence on removable media. This included a campaign to improve information handling such as the management of discs, and ensuring that sensitive information is identified and redacted, as well as messages from senior management and training (one area had a poster campaign on this).

| Performance heading | Performance rating | Priority | |--------------------------------------|--------------------------|----------| | 3.2 Establishing control | Satisfactory | Low |

- CPS has an Information Assurance Group (IAG) which provides an opportunity for collaborative working among security, records and technology teams. The IAG serves as forum for discussions around information and records management, and should be a useful body to review and sign off policies around information assurance and management. See good practice

- We were pleased to see that there are Information Management Advisors based in the business who are the local area ambassadors that promote and assure good working practices are undertaken. The Security and Information Assurance Directorate holds regular training events and workshops for Information Management Advisors. Information Management Advisors handle information and records management, and security, which has raised a question around how much time they can devote to these activities alongside their day job. CPS needs to ensure that Advisors can sufficiently cover their duties in addition to other responsibilities. See recommendation 2

- The Records Management Unit (RMU) is a small team, and its capacity for outreach (promoting policy and guidance on information and records management) across the business is limited. As a result, the relationship between RMU and the Information Management Advisors is an important one. CPS should review how it promotes policy and compliance to ensure sufficient space is given to these activities. See recommendation 2

| Performance heading | Performance rating | Priority | |---------------------|--------------------|----------| | 3.3 Providing guidance | Development needed | Medium |

- Despite a good understanding of the value of information, staff are still storing information on personal drives and in email accounts, particularly non-case information. Staff need a clear steer through policy guidance and training on what records should be kept and where. See recommendation 1

- CPS has a draft Information and Records Management Policy which clearly sets out expectations, and roles and responsibilities around information and records management. The policy will play a crucial part in helping CPS to ensure staff manage their records and information properly in both the current and future IT environments. CPS needs to complete work on the policy, and consider how best to launch, promote and embed it across the organisation. See recommendation 1

- What to Keep guidance has been drafted. It includes information on what is a record, where records should be kept, advice on setting up filing structures on shared drives, retention periods, and responsibility for disposal (what not to keep). It also includes a statement that social media should not be used for record keeping purposes. CPS should get this signed off, and consider how best to launch, promote and embed this across the organisation. See recommendation 1

- A National File Standard is in place and covers what should be kept as part of the case record. Staff we spoke to were fully aware of this and used it. It is published on GOV.UK. The National File Standard is not owned by RMU and it is important that these standards are aligned with any guidance produced by RMU. See recommendation 1 • CPS is also jointly working with the police to develop naming conventions in order to make these documents more easily accessible as part of the case file.

| Performance heading | Performance rating | Priority | |---------------------------|--------------------------|----------| | 3.4 Measuring Impact | Development needed | Medium |

• Quarterly assurance checks do include how information is used, stored and handled. CPS should consider whether this gives sufficient oversight on whether staff are complying with information and records management policy – for example, whether they are saving the right records in the right locations. If not, CPS needs to develop a proportionate approach to monitoring compliance drawing on the approach that other government departments have taken. See recommendation 2

4 Records, review and transfer

| Performance heading | Performance rating | Priority | |-------------------------------------------|--------------------|----------| | 4.1 Oversight of records and selection | Satisfactory | Low |

• There is substantial knowledge and experience within the RMU. However, it is a small team and departmental or team changes will impact on its ability to discharge its functions under the Public Records Act. Also, the move to digital working means that new skills will need to be acquired within the team. CPS needs to capture and share knowledge, and upskill staff in order to ensure that capacity is maintained over time. See recommendation 6

• CPS have worked hard to process their paper legacy, including attending the Advisory Council on National Records and Archives, and are engaging an outside contractor to help them speed up the work. There is a good process in place for the appraisal and selection of case records. See good practice

• It was not clear whether any other corporate information was considered for selection such as board minutes or records of significant projects, and there is a possible risk that information of potential historical value is being overlooked. CPS should work with The National Archives to bring non-case information into the appraisal process. See recommendation 8 | Performance heading | Performance rating | Priority | |-------------------------------------|--------------------------|----------| | 4.2 Implementing disposal decisions | Development needed | Medium |

- CPS has been using a third party contractor, Iron Mountain, to carry out sensitivity review and preparation of records for transfer. This arrangement seemed to be working well at the time of the IMA. See good practice

- Disposal is currently on hold due to the Independent Inquiry into Child Sexual Abuse and the Undercover Policing Inquiry. The nature of the records and risk appetite within CPS means that this situation will continue for the foreseeable future. Retention periods are still being applied to paper and digital records they are just not being actioned.

- CPS is yet to develop a process for carrying out appraisal, selection, sensitivity review, and transfer of digital information held within CMS on shared drives and other digital systems that are in use. CPS has estimated that are not due to transfer digital information until 2023. However, CPS will benefit from starting to plan for this now and building it into their future approach to managing digital information. See recommendation 6 Annex A – Recommendations in full

- Recommendations consist of an overall outcome to be delivered through the period of the Crown Prosecution Service (CPS) Information Management Assessment action plan and a set of supporting actions that will help CPS address the recommendation.

Medium-priority recommendations

| 1 | |---| | **CPS must ensure that it has up to date policy and guidance in place to support a good culture of information and records management particularly in light of future IT developments such as O365 and Common Platform.** |

**This would be supported by:**

- Completing work on the Information and Records Management Policy and ensuring that this has senior sign off
- Considering how best to launch, promote and embed the Information and Records Management Policy across the organisation
- Reviewing and updating the policy in line with developments on the Compass case management system (CMS) and the Common Platform
- Completing work on the What to Keep guidance and securing senior sign off
- Considering how best to launch, promote and embed this across the organisation
- Exploring the possibility of producing some quick reference guides for the Information and Records Management Policy and What to Keep guidance to make them even more accessible to staff
- Ensuring that policies and guidance particularly highlight that records (including email) of corporate value or that make-up part of the case record should be moved to CMS or the shared drives as appropriate
- Ensuring that National File Standards are aligned with any guidance produced by the Records Management Unit (RMU)
- Publish guidance on What to Keep/retention on GOV.UK as recommended by Sir Alex Allan in his Report on Records Review. Building on the good work it has already done for security and information assurance, CPS needs to ensure it has the right governance structures and processes in place to support and monitor compliance with information and records management policy.

This would be supported by:

- Considering whether the quarterly assurance process gives sufficient oversight on whether staff are complying with information and records management policy, for example, whether staff are saving the right records in the right locations.

- Developing a proportionate approach to measuring whether staff are complying with the Records Management Policy, if assurance checks are not felt to cover this sufficiently. CPS would benefit from looking at how other government departments have done this including HM Treasury and Home Office.

- Reviewing how CPS promotes policy and compliance to ensure sufficient space is given to these activities.

- Ensuring that RMU is able to focus on developing and promoting information and records management policy across CPS with support from the Information Management Advisors.

- Ensuring that IMAs are able to sufficiently cover information and records management duties in addition to other responsibilities.

- Using IMAs and at a more senior level, Area Business Managers, to promote the Information and Records Management Policy and What to Keep guidance once signed off.

- Clarifying the relationship between the IMA role and the new Compliance and Assurance Officers.

- Continuing to use the Information Assurance Group as a forum for discussion of information and records management issues and review and sign off of related policies and guidance. CPS should continue to ensure that it has the right systems and processes in place to manage digital information (both case and non-case information).

This would be supported by:

- Exploring how records and accompanying metadata will be exported from CMS without them being changed or interfered with in any other way
- Continuing to ensure that CMS remains fit for purpose until such time as it is replaced
- Engaging with business areas about possible gaps and changes to CMS and updating related guidance
- Ensuring that corporate information held in other locations such as SharePoint and shared drives is managed appropriately throughout its lifecycle
- Defining its approach to information management within Office 365, including defining its requirements for information and records management
- Considering the impact that having unlimited space on One Drive and email might have on ensuring that case information is saved in CMS, and on the management of corporate information more generally
- Learning from other departments work on Office 365, including Parliament and Home Office
- Looking at any technical controls that can be applied such as size limits to encourage staff to save information in the right location
- Recognising the risks that easier sharing of video evidence digitally/online pose to the secure management and protection of this information, and ensuring that appropriate mitigations are in place. CPS should take steps to ensure that its digital information remains available and usable throughout change and over time.

This would be supported by:

- Developing a plan for the management of information on the shared drives and other locations in the medium and longer term
- Further exploring the use of software tools (including DROID, The National Archives' free file profiling tool) to establish what the shared drives contain (including age, format, size, duplicates etc.). RMU should work together with digital colleagues on this
- Establishing vulnerabilities associated with age or format and identifying mitigations
- Identifying material on the shared drives that can be disposed of such as duplicates or information that is no longer of business value and not required by Independent Inquiry into Child Sexual Abuse or the Undercover Policing Inquiry. This would reduce the volume of information that needs to be maintained, protected, migrated and processed at a later date
- Ensuring that information and records management requirements are considered at the outset for new IT projects or programmes and as a standard part of the IT procurement process
- Linking up with other departments currently running joint projects such as Defra to discuss approach and lessons learnt
- Defining the risk that video evidence may become inaccessible, unavailable or unusable if not managed appropriately and working with police forces to mitigate.

CPS needs to ensure that risks around capturing and keeping the right information to ensure it is available to the right people at the right time are routinely recognised and managed as part of the risk management framework.

This would be supported by:

- Completing work on the Security and Information Assurance Policy and getting senior sign off
- Considering how best to launch, promote and embed the policy across the organisation
- Ensuring that there is a definition of information risk and that is included in policy guidance and training
- Supporting business areas in understanding how to identify risks around capturing and keeping the right information and information availability.

6

**Working closely with The National Archives, CPS needs to develop a process for carrying out appraisal, selection, sensitivity review and transfer of digital information.**

**This would be supported by:**

- Producing an appraisal report for CPS
- Using the Information Management Report (paper and digital parts) to regularly provide The National Archives with up to date information that can be used for more detailed planning
- Developing a method of selecting, sensitivity reviewing and transferring case information on CMS to The National Archives
- Surveying information on the shared drives and other areas such as SharePoint in order to identify information of historical value (this should cover case and non-case records) and establishing a process for transferring this to The National Archives
- Considering the use of tools to assist the process including DROID
- Exploring the approach that other government departments are taking on digital appraisal, sensitivity review and transfer
- As work on the Common Platform moves forward, start to think about how appraisal, sensitivity review and transfer might work and build in from the outset where possible
- Ensuring that RMU continue to grow their digital skills to support this work.

## Recommendations to maintain a satisfactory rating

### 7

**CPS should join up its strategic goals for information and records management, demonstrate how these support the wider strategic direction within the department and ensure there is a plan for implementation.**

**This would be supported by:**

- Ensuring that strategic goals include driving/maintaining the right culture of information and records management across CPS
- Aligning strategic goals for information and records management with the Digital and Architecture strategies
- Ensuring that a plan for implementation is in place
- Championing these strategic goals at a senior level

### 8

**CPS needs to maintain capability in order to appraise, select and transfer paper records in accordance with the Public Records Act and 20-year rule.**

**This would be supported by:**

- Capturing and sharing knowledge within the RMU to ensure that capability is maintained throughout any future departmental or team changes
- Ensuring that CPS has the capacity internally and through using third party contractors, to keep pace with the transition to the 20-year rule
- Bringing non case records into the appraisal process and identifying any of historical value
- Producing an appraisal report for CPS covering case and non-case records (this will also help to inform selection of digital records).